CVE-2020-27040: 
NixOS vulnerability analysis and mitigation

In phNxpNciHal_core_initialized of phNxpNciHal.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the NFC server with System execution privileges needed. User interaction is not needed for exploitation. The vulnerability affects Android 11 (Android Security Bulletin).

The vulnerability is tracked as CVE-2020-27040 and has been assigned a CVSS v3.1 Base Score of 4.4 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified as CWE-125 (Out-of-bounds Read) and occurs due to a missing bounds check in the phNxpNciHal_core_initialized function of phNxpNciHal.cc (NVD).

The successful exploitation of this vulnerability could lead to local information disclosure from the NFC server. The attack requires System execution privileges, but no user interaction is needed for exploitation (NVD).

The vulnerability requires local access and high privileges for exploitation. No known exploits have been reported in the wild at the time of disclosure (NVD).

The vulnerability was addressed in the Android Security Bulletin for December 2020. Users should update their Android devices to the latest security patch level to mitigate this vulnerability (Android Security Bulletin).